Overview

overview

10

Static

static

3

ecbd4f8516...3N.exe

windows7-x64

10

ecbd4f8516...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-01-2025 14:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecbd4f851628a8e82ef458454ee490fed137b863e5adba90a7574a001e1f79a3N.exe

  • Size

    1.5MB

  • MD5

    368ba276407bceef1d4df345743b6180

  • SHA1

    0d704acfa11ad481a39a476b21a748b0b553f4ae

  • SHA256

    ecbd4f851628a8e82ef458454ee490fed137b863e5adba90a7574a001e1f79a3

  • SHA512

    466c41a25a2fbebf8c1a15d4a272722621d64a09f63e09ea784be986b37ec766bd23b534ba42f678d881e0b21026f11c6757eb9bde7e717b67b31b816f453bb1

  • SSDEEP

    24576:UNNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:kzhWhCXQFN+0IEuQgyiVK

Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
    persistence
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
    evasiontrojan
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecbd4f851628a8e82ef458454ee490fed137b863e5adba90a7574a001e1f79a3N.exe
    "C:\Users\Admin\AppData\Local\Temp\ecbd4f851628a8e82ef458454ee490fed137b863e5adba90a7574a001e1f79a3N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ecbd4f851628a8e82ef458454ee490fed137b863e5adba90a7574a001e1f79a3N.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4512
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\dllhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4192
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\CoreShellExtFramework\spoolsv.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2168
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\MusNotification.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\opengl32\winlogon.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bootstat\explorer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4972
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Local Settings\fontdrvhost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApi.ProxyStub\SearchApp.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\SppExtComObj.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3348
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ye4UkqhMDX.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:1984
        • C:\Windows\bootstat\explorer.exe
          "C:\Windows\bootstat\explorer.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4752
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ae1745d-3833-445a-ad21-80adc26b93c1.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1552
            • C:\Windows\bootstat\explorer.exe
              C:\Windows\bootstat\explorer.exe
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1508
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\568458ca-1d67-48ad-8f8b-08213fdcc1a5.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2400
                • C:\Windows\bootstat\explorer.exe
                  C:\Windows\bootstat\explorer.exe
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4424
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1216f052-f8fa-4ce1-968f-310ad6a364a3.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4000
                    • C:\Windows\bootstat\explorer.exe
                      C:\Windows\bootstat\explorer.exe
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:1468
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a5274eb-5bee-42a3-ba3d-b82623f1ff0e.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1984
                        • C:\Windows\bootstat\explorer.exe
                          C:\Windows\bootstat\explorer.exe
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4564
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7eff6ca-65dc-4625-8636-3bc10cff37d0.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4444
                            • C:\Windows\bootstat\explorer.exe
                              C:\Windows\bootstat\explorer.exe
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4928
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b90691d4-4605-421c-9d1b-9ee6dfad91c1.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:428
                                • C:\Windows\bootstat\explorer.exe
                                  C:\Windows\bootstat\explorer.exe
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:408
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14f843b2-c361-48b6-9b6e-48b2220b32b4.vbs"
                                    16⤵
                                      PID:4588
                                      • C:\Windows\bootstat\explorer.exe
                                        C:\Windows\bootstat\explorer.exe
                                        17⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2896
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64d0bb5b-5952-4347-9e18-56559994350e.vbs"
                                          18⤵
                                            PID:4288
                                            • C:\Windows\bootstat\explorer.exe
                                              C:\Windows\bootstat\explorer.exe
                                              19⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:3672
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0fef24c-3d66-4295-a89e-9469fa0f45f6.vbs"
                                                20⤵
                                                  PID:3940
                                                  • C:\Windows\bootstat\explorer.exe
                                                    C:\Windows\bootstat\explorer.exe
                                                    21⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:440
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9139dfb8-e925-40da-bf3c-977b2e339f74.vbs"
                                                      22⤵
                                                        PID:2288
                                                        • C:\Windows\bootstat\explorer.exe
                                                          C:\Windows\bootstat\explorer.exe
                                                          23⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:3272
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17ae8b28-c489-4d85-8fd4-5d155ca2fa3e.vbs"
                                                            24⤵
                                                              PID:4040
                                                              • C:\Windows\bootstat\explorer.exe
                                                                C:\Windows\bootstat\explorer.exe
                                                                25⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:64
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9abc9ee0-5a94-47f3-978c-2c460214772e.vbs"
                                                                  26⤵
                                                                    PID:3676
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e89a75d3-c5a5-4d15-9ca6-91339312f83b.vbs"
                                                                    26⤵
                                                                      PID:1340
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fc439c2-8bfa-40cc-b16b-af6c3fc61590.vbs"
                                                                  24⤵
                                                                    PID:1736
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d1bdb59-88be-4a2f-9725-120f3d9725fb.vbs"
                                                                22⤵
                                                                  PID:3900
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\473646a1-79bf-4646-b37e-1e1d448edba9.vbs"
                                                              20⤵
                                                                PID:2084
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99dc6a2a-af39-45f6-b113-772da56e2275.vbs"
                                                            18⤵
                                                              PID:708
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85bba830-77f4-483b-b9ea-63845ba54a5e.vbs"
                                                          16⤵
                                                            PID:2668
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfe2d046-4a36-4273-9650-8d855cc3d247.vbs"
                                                        14⤵
                                                          PID:1684
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82b47fbd-fd6d-47f4-9d80-f363c7c4e878.vbs"
                                                      12⤵
                                                        PID:2988
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ffe255e6-5e7e-484e-ad7e-6c00c5f6d31f.vbs"
                                                    10⤵
                                                      PID:1120
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c305b94-d3fe-410e-8eb0-6d8587261b4b.vbs"
                                                  8⤵
                                                    PID:2020
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e0eb767-7be7-425d-aef1-976a38706fa6.vbs"
                                                6⤵
                                                  PID:4696
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58dc1e0c-8a4d-4c84-ad8c-a054e9e0fc8c.vbs"
                                              4⤵
                                                PID:3704
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\dllhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4924
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\CoreShellExtFramework\spoolsv.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2992
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Documents and Settings\MusNotification.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3996
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\opengl32\winlogon.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4412
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3484
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\bootstat\explorer.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4976
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\fontdrvhost.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:1844
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApi.ProxyStub\SearchApp.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2796
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Templates\SppExtComObj.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Process spawned unexpected child process
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:2220

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Command and Scripting Interpreter

                                        1
                                        T1059

                                        PowerShell

                                        1
                                        T1059.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        2
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Winlogon Helper DLL

                                        1
                                        T1547.004

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Privilege Escalation

                                        Abuse Elevation Control Mechanism

                                        1
                                        T1548

                                        Bypass User Account Control

                                        1
                                        T1548.002

                                        Boot or Logon Autostart Execution

                                        2
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Winlogon Helper DLL

                                        1
                                        T1547.004

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Defense Evasion

                                        Abuse Elevation Control Mechanism

                                        1
                                        T1548

                                        Bypass User Account Control

                                        1
                                        T1548.002

                                        Impair Defenses

                                        1
                                        T1562

                                        Disable or Modify Tools

                                        1
                                        T1562.001

                                        Modify Registry

                                        4
                                        T1112

                                        Credential Access

                                        Discovery

                                        Query Registry

                                        2
                                        T1012

                                        System Information Discovery

                                        3
                                        T1082

                                        Lateral Movement

                                        Collection

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\ProgramData\SoftwareDistribution\OfficeClickToRun.exe
                                          Filesize

                                          1.5MB

                                          MD5

                                          368ba276407bceef1d4df345743b6180

                                          SHA1

                                          0d704acfa11ad481a39a476b21a748b0b553f4ae

                                          SHA256

                                          ecbd4f851628a8e82ef458454ee490fed137b863e5adba90a7574a001e1f79a3

                                          SHA512

                                          466c41a25a2fbebf8c1a15d4a272722621d64a09f63e09ea784be986b37ec766bd23b534ba42f678d881e0b21026f11c6757eb9bde7e717b67b31b816f453bb1

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log
                                          Filesize

                                          1KB

                                          MD5

                                          baf55b95da4a601229647f25dad12878

                                          SHA1

                                          abc16954ebfd213733c4493fc1910164d825cac8

                                          SHA256

                                          ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                          SHA512

                                          24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                          Filesize

                                          2KB

                                          MD5

                                          d85ba6ff808d9e5444a4b369f5bc2730

                                          SHA1

                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                          SHA256

                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                          SHA512

                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          7e480015ea11e6116c4f2d65bda671ba

                                          SHA1

                                          54a24d189df57e0694ad0f45c959d261563346fe

                                          SHA256

                                          7903bc768294a7c55726370a68e9f132a5108470aa680d1fb89f83147f9e2c66

                                          SHA512

                                          4be16fd1319e781fab6efa61aeeee838edb307222b00715ccaac3ebf10f16fb728b0b52c196ff3db4c118f3009af365e2b5b6e5ae4b53777ae78278adfd61437

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          6d3e9c29fe44e90aae6ed30ccf799ca8

                                          SHA1

                                          c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                          SHA256

                                          2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                          SHA512

                                          60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          cadef9abd087803c630df65264a6c81c

                                          SHA1

                                          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                          SHA256

                                          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                          SHA512

                                          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          d28a889fd956d5cb3accfbaf1143eb6f

                                          SHA1

                                          157ba54b365341f8ff06707d996b3635da8446f7

                                          SHA256

                                          21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                          SHA512

                                          0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                          Filesize

                                          944B

                                          MD5

                                          62623d22bd9e037191765d5083ce16a3

                                          SHA1

                                          4a07da6872672f715a4780513d95ed8ddeefd259

                                          SHA256

                                          95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                          SHA512

                                          9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\0a5274eb-5bee-42a3-ba3d-b82623f1ff0e.vbs
                                          Filesize

                                          708B

                                          MD5

                                          969de32c5ca7e352574640c6b6e7d063

                                          SHA1

                                          01c0674f4b47e7d3117d9b74c869ad5f99d8dc5f

                                          SHA256

                                          667253b6725339a944983e901a67f0e896d8ef8b14e958f599c7d7a4e041da04

                                          SHA512

                                          6c56286b30bb9412f2dacbff72c04e0cf3ea54c8f3bbcaa9c8796e5c85ceaa65c30df98cd5d1e9a4cb654587d012a6d03b907df7cfc1d6d2a6d8e0434c7906c1

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\1216f052-f8fa-4ce1-968f-310ad6a364a3.vbs
                                          Filesize

                                          708B

                                          MD5

                                          64fcd60262b054329c9aab30f9a61667

                                          SHA1

                                          27481b19ccc5b20f5b8bf2598ae0b9ce571801a2

                                          SHA256

                                          cd27ffd3c9512155f363e81f6e6d3f5768257325e4bc3efb47afff9b39d25818

                                          SHA512

                                          17c7b1c80de42b11f663e773001922a504a80b6c9f41e200c2fe88fd4df6da361a655555add7245f06d472a19820877243d1c6a0d1136729e135b2bc58c772a5

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\14f843b2-c361-48b6-9b6e-48b2220b32b4.vbs
                                          Filesize

                                          707B

                                          MD5

                                          b638c43c6b3be92aba660614e494ce12

                                          SHA1

                                          1983a462fc9989c0187a7784ce7620fcb6ac4cbb

                                          SHA256

                                          5b9a7faaa35b7459fedd7fc4f29d1c11a19d4bc71360b53057cf5cfb57be9487

                                          SHA512

                                          e5a7d0c6cb92a490dfb64e175bdab32c685dda617f8725573cc7e89eed71c74dd2a22c022e5de2a3659bdcdd2105b709bcfab90ece4dddcb80f8ecf6dc09c08c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\17ae8b28-c489-4d85-8fd4-5d155ca2fa3e.vbs
                                          Filesize

                                          708B

                                          MD5

                                          3a625b49f28b5060c331e2b7dae76968

                                          SHA1

                                          92e8012b77960898a6ab67a47be2275673001656

                                          SHA256

                                          04f84d492aa94ab85d5aa7402617ad689cf35614721c972ee1d476bc6a9f76e1

                                          SHA512

                                          96646eeb55fd1f8ebcc9d09e28a02c7ed3d2f21ac5c437067751017129825b28e8af8c91fabb2777caf625afd8c103b24951484a5dee6eb947c41f214618645c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\568458ca-1d67-48ad-8f8b-08213fdcc1a5.vbs
                                          Filesize

                                          708B

                                          MD5

                                          ac42d5c65b5f6041c258f2674d90d92b

                                          SHA1

                                          bf244477be5ed0ee86b22d4617f40e9c46272db4

                                          SHA256

                                          991e067a69599104d309996259c8d1993adabf7ce2a1cc04a533ff49fb26eb77

                                          SHA512

                                          d26698d53ece7fa5f37249937bceb26012753126e53ffa0170c99d2a58eda21eade9c49f00be266cded55e42b37682751571b7e60a64791ba5b527e1e9c1bddb

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\58dc1e0c-8a4d-4c84-ad8c-a054e9e0fc8c.vbs
                                          Filesize

                                          484B

                                          MD5

                                          eb63e4fb460b6bec353f7190f219cad3

                                          SHA1

                                          1f2b1a97de3e79b876d6f9a32839c9d740cf6cfb

                                          SHA256

                                          f2cdf0744cd76be2470de6eda188f30227fafb0b1c4012310235bbc547eb8b76

                                          SHA512

                                          fc531ca6e4b1465e2ab93d595163e3655e8a98cd03c9e038c0bbc194dd8e8aaaae8b6f2fddc9310dd51a24231150aaeeea812e5035424a2300d63ee4a8284497

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\64d0bb5b-5952-4347-9e18-56559994350e.vbs
                                          Filesize

                                          708B

                                          MD5

                                          0de078fef939ebd0ab128043f012a6c8

                                          SHA1

                                          0e9a0db6ebc13411537caf2a8cee23238adfb09c

                                          SHA256

                                          5b6b52a4d86233993835804fc067b6c29221749bd6f76a618ff8bfc477948dfb

                                          SHA512

                                          06230e3b528d9538b899bca8ec592725bd2e18838aed2d11b1c0a554ceeed601293609ca29f1c0a80a2e6c2c8cb60db058f4c511da9bb840b2083baa51419536

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\9139dfb8-e925-40da-bf3c-977b2e339f74.vbs
                                          Filesize

                                          707B

                                          MD5

                                          1f23f409a37a664cfa6c48e8d782202d

                                          SHA1

                                          56876f3e12cc15672c9c3652e4f1692dca12ea29

                                          SHA256

                                          9684d0be5541cc5f43f56347c05752158e3c37b51f4082208f3957881c9a39c0

                                          SHA512

                                          d49f390032f2f1bbae5e6069e16596479d15a306ab3a6720838bb8870a64005c5c49c7af469ef85008d6bcc757d0214ae516d82338138f86709324b05cddddc8

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\9abc9ee0-5a94-47f3-978c-2c460214772e.vbs
                                          Filesize

                                          706B

                                          MD5

                                          6341826f5e29ab4a136cc20a99b1438a

                                          SHA1

                                          3baec05a04eca4e515d058886d4ae6828fecbda2

                                          SHA256

                                          2ba14463988b6abd377c9b0caf10f1f60f3543f947bbd7c78a2c682bff4706ea

                                          SHA512

                                          4afd7e787d5ca25549a5c09674f446213e933d2e5beb7b350a17ad3b7f57f837995d369b564b8cb6383652cefff9c62f8bc9e45c660f7e8dfa8f789a8708ec4b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\9ae1745d-3833-445a-ad21-80adc26b93c1.vbs
                                          Filesize

                                          708B

                                          MD5

                                          9f27431c47d1e5df9b2c6004cca13f0a

                                          SHA1

                                          8c123afd36bd67d67e3421636ddc0716aae95e02

                                          SHA256

                                          22285533bd6921ed0d1bd13077eae3a54b3600dcfafcc3d4940e07f065c2228e

                                          SHA512

                                          738a15fcb714cc9e6ad3376035ae9aa24ce3dfc05025266520a7d557ba47733ed1e351c8ffc8cbb842bce8801402dc9bceead8c50168f222a4f0d4c2c346b53b

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_colrcxlh.kep.ps1
                                          Filesize

                                          60B

                                          MD5

                                          d17fe0a3f47be24a6453e9ef58c94641

                                          SHA1

                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                          SHA256

                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                          SHA512

                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\b90691d4-4605-421c-9d1b-9ee6dfad91c1.vbs
                                          Filesize

                                          708B

                                          MD5

                                          c36d4f52147200b7e51f5d6873e0f9a6

                                          SHA1

                                          ad53ec767019a67a618fcf588de8f99297a1672d

                                          SHA256

                                          059a2d0ce383f3fb1bac094ab178e2507e09116273dc2c1e321c877ebe8b5a01

                                          SHA512

                                          60c025e605d190aa90e0afd2dc1f74f4e77d59ea135102720bdb1c6266523579d4d99edb4733dbe37b6a9be13ff3aeb7297ef8bbb15e00673a5d115bf79aa9a5

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\c0fef24c-3d66-4295-a89e-9469fa0f45f6.vbs
                                          Filesize

                                          708B

                                          MD5

                                          a8347c0a28ea5555f742c56dd7d6c068

                                          SHA1

                                          6e8ef0f2ad3c6ef7bc0a0ce383c6d1acf6c63cda

                                          SHA256

                                          7a6365bf32a2c770e4f5e814b780eafe4d2bff8ccb194d67b5734abea6a3e5c6

                                          SHA512

                                          65d3385894ae6ba25c51e49f9ca666a49b56cba5641210177c923ea026028a63be83036db2c56981c7b0c6cf4b2d1930169fa2b518eb8f43ab045d862b55a821

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\c7eff6ca-65dc-4625-8636-3bc10cff37d0.vbs
                                          Filesize

                                          708B

                                          MD5

                                          aa135f80be699c95a7b1c83ba9f741ed

                                          SHA1

                                          fca8bc12d9cd3e061b1f723c25ad126b6170f281

                                          SHA256

                                          b459d0be0dd4ce98bd68fec6d5084bd4e1b319911896d7bcffec996bc101c5bb

                                          SHA512

                                          7b366389f426e5f2f844585f2b95b6834cb6763aac117f9ebcdee71d2928a5a7f2fe732a4d335d8241b23d02cb147ef8aea4975d4a6b5521978bc66300f22bc9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\ye4UkqhMDX.bat
                                          Filesize

                                          196B

                                          MD5

                                          9207588a31ff6d8d110b03c3fff2059d

                                          SHA1

                                          f93ab16278b038d39e2b70c86b2638fdb25a26ee

                                          SHA256

                                          373b2f4b7237e57520dda755810976856e5c955d689ed016719bd0b10b9750be

                                          SHA512

                                          bc054b4678801c5944db6b877a36beb35cc076e510f0fd40deb1741d133b239eb5b02457e618206abb87179e46624cae124b38243992ef653ba257015c03f55f

                                          Download Submit

                                        • C:\Windows\bootstat\explorer.exe
                                          Filesize

                                          1.5MB

                                          MD5

                                          f5d2d987462df34f3ab580327ae02d92

                                          SHA1

                                          3b7e2165780d2fec5c686c7eb8428b1de3513bc8

                                          SHA256

                                          89640d0c24454b87e62b0597169a14871ef2fd904110370fd978f00970a1edc0

                                          SHA512

                                          3996a2e5963b3508b9d5cdb2b418fa001beb53f165fb8ec57efccdd919a7302a4b1e9662a42df0471f68a35576b8e0c95811706404f6fa9c20f68895063d2345

                                          Download Submit

                                        • memory/852-12-0x000000001C130000-0x000000001C138000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/852-13-0x000000001C240000-0x000000001C24A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/852-1-0x0000000000D00000-0x0000000000E7E000-memory.dmp

                                          Filesize

                                          1.5MB

                                          Download

                                        • memory/852-25-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

                                          Filesize

                                          10.8MB

                                          Download

                                        • memory/852-24-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

                                          Filesize

                                          10.8MB

                                          Download

                                        • memory/852-21-0x000000001C210000-0x000000001C218000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/852-20-0x000000001C190000-0x000000001C19C000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/852-18-0x000000001C180000-0x000000001C188000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/852-17-0x000000001C170000-0x000000001C17C000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/852-16-0x000000001C160000-0x000000001C168000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/852-15-0x000000001C150000-0x000000001C15A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/852-2-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

                                          Filesize

                                          10.8MB

                                          Download

                                        • memory/852-3-0x00000000017E0000-0x00000000017E8000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/852-14-0x000000001C140000-0x000000001C14C000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/852-0-0x00007FFB52733000-0x00007FFB52735000-memory.dmp

                                          Filesize

                                          8KB

                                          Download

                                        • memory/852-133-0x00007FFB52730000-0x00007FFB531F1000-memory.dmp

                                          Filesize

                                          10.8MB

                                          Download

                                        • memory/852-11-0x000000001C120000-0x000000001C130000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/852-4-0x000000001BA90000-0x000000001BAA2000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/852-10-0x000000001BC00000-0x000000001BC10000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/852-9-0x000000001BBF0000-0x000000001BBFC000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/852-8-0x000000001BBE0000-0x000000001BBE8000-memory.dmp

                                          Filesize

                                          32KB

                                          Download

                                        • memory/852-7-0x000000001BBD0000-0x000000001BBDC000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/852-6-0x000000001BBC0000-0x000000001BBCA000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/852-5-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

                                          Filesize

                                          48KB

                                          Download

                                        • memory/2168-123-0x0000022B04BD0000-0x0000022B04BF2000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/2896-307-0x000000001ACD0000-0x000000001ACE2000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/4424-251-0x0000000000BF0000-0x0000000000C02000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/4752-227-0x0000000003010000-0x0000000003022000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/4752-226-0x0000000000D80000-0x0000000000EFE000-memory.dmp

                                          Filesize

                                          1.5MB

                                          Download